Section 1 Short title
This Act may be cited as the “Car Privacy Rights Act of 2024”.
Car Privacy Rights Act of 2024
A BILL
To restrict car manufacturers and other companies from selling consumer car-related data, increase transparency regarding data practices, and for other purposes.
Sec. 2 Restricting the sharing or selling of consumer car-related data
In general— Subject to subsections (b) and (c), it shall be unlawful for a covered entity to share or sell any consumer car-related data of a consumer unless—
the covered entity provides the consumer—
a notice that—
the covered entity intends to share or sell such data;
is provided in a clear and conspicuous standalone disclosure that describes each instance the covered entity plans to share or sell such data;
states for each specific category of such data if the covered entity is sharing or selling such data in order to provide a service requested by the consumer or for another purpose;
is written in easy-to-understand language;
is provided by a means that would be reasonably anticipated by the consumer given the relationship between the consumer and the covered entity; and
is accessible to persons with disabilities; and
an opportunity to explicitly grant affirmative express consent to allow the covered entity to share or sell such data; and
the consumer explicitly grants such affirmative express consent.
Revocation of consent— If a consumer grants affirmative express consent to allow a covered entity to share or sell the data of such consumer pursuant to subsection (a)(2), the covered entity shall allow such consumer to easily revoke such consent directly through the website of the covered entity, or application of the covered entity, or through direct mail.
Exception— Subsection (a) shall not apply to any data a covered entity shares with the National Highway Traffic Safety Administration.
Sec. 3 Reporting of consumer data privacy practices
In general— Not later than 120 days after the date of enactment of this Act and annually thereafter, each car manufacturer and motor vehicle insurance company shall submit a report to the Commission regarding their consumer data privacy practices, including any consumer car-related data that are being collected, the purpose behind such data being collected, what entities are being shared or sold such data, and an overview of their data sharing practices.
FTC report— Not later than 180 days after the date described in subsection (a) and annually thereafter, the Commission shall submit to Congress and publish on the website of the Commission a report containing a summary of the information described in subsection (a).
Sec. 4 Guidance or rulemaking regarding car manufacturers addressing domestic violence issues related to their applications
Not later than 180 days after the date of enactment of this Act, the Commission, in consultation with the Federal Communications Commission and the National Highway Traffic Safety Administration, shall issue guidance or promulgate regulations regarding how car manufacturers can address domestic violence issues related to any application of a car manufacturer that has the capability to determine the precise geolocation of an individual, consumer car, or device.
Sec. 5 Enforcement
Unfair or deceptive acts or practices— A violation of this Act or a regulation promulgated under this Act shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
Powers of the Commission—
In general— The Commission shall enforce this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act.
Privileges and immunities— Any person who violates this Act or a regulation promulgated under this Act shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.).
Authority preserved— Nothing in this section shall be construed to limit the authority of the Commission under any other provision of law.
Rulemaking— The Commission shall promulgate in accordance with section 553 of title 5, United States Code, such rules as may be necessary to carry out this Act.
Sec. 6 Definitions
In this Act:
Affirmative express consent— The term affirmative express consent means an affirmative act by a consumer that—
clearly communicates the authorization of the consumer for an act or practice;
is provided in response to a notice that meets the requirements of section 2(a)(1)(A); and
is not—
acceptance of general or broad terms of service or a similar document;
accomplished by hovering over, muting, pausing, or closing a given piece of content; or
acceptance of an agreement obtained through the use of false, fraudulent, or materially misleading means.
Application— The term application means a software program that runs on the operating system of a device.
Commission— The term Commission means the Federal Trade Commission.
Consumer— The term consumer means an individual who is a citizen or resident of, or located in, the United States.
Consumer car— The term consumer car means a motor vehicle, as defined in section 30102 of title 49, United States Code, that is owned, leased, or operated by a consumer, but excluding any motor vehicle owned, leased, or operated in a commercial or employment context.
Consumer car-related data— The term consumer car-related data means any information, including derived data and unique identifiers, that is—
linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device; and
collected or derived from and describes the historic operation, condition, status, or precise geolocation of a consumer car or its occupants.
Covered entity— The term covered entity means any person that collects the consumer car-related data of an individual, including car manufacturers, insurance companies, and companies that collect such data through digital applications.
Device— The term device means any electronic equipment capable of collecting, processing, retaining, or transferring consumer car-related data, including such devices equipped on a consumer car.
Precise Geolocation— The term precise geolocation means information that reveals the past or present physical location of an individual, consumer car, or device with sufficient precision to identify—
street-level location information of such individual, consumer car, or device; or
the location of such individual, consumer car, or device within a range of 1,850 feet or less.